Critical Vulnerabilities in CrewAI Framework Enable Remote Code Execution and Data Theft Security researcher Yarden Porat of Cyata has uncovered four critical vulnerabilities in CrewAI, an open-source Python-based framework for multi-agent AI orchestration. If chained together, these flaws could allow threat actors to execute arbitrary code, access sensitive files, and steal credentials from affected systems. The vulnerabilities CVE-2026-2275, CVE-2026-2286, CVE-2026-2287, and CVE-2026-2285 stem from improper configurations and insecure fallback mechanisms in the Code Interpreter tool, which enables Python code execution within a Docker container. The first flaw (CVE-2026-2275) occurs when the tool defaults to an insecure SandboxPython environment if Docker is unavailable, allowing arbitrary C function calls if code execution is enabled in the agent’s configuration. Exploiting this flaw can trigger the remaining vulnerabilities: - CVE-2026-2286: A server-side request forgery (SSRF) bug in RAG search tools, enabling attackers to access internal and cloud services due to improper URL validation. - CVE-2026-2287: A remote code execution (RCE) risk caused by CrewAI failing to verify Docker’s runtime status, falling back to an insecure sandbox. - CVE-2026-2285: An arbitrary file read issue in the JSON loader tool, allowing unauthorized access to local files due to unvalidated file paths. Attackers could exploit these flaws through direct or indirect prompt injections, bypassing sandbox protections to execute code on the host machine or exfiltrate data. While no official patch has been released, CrewAI’s maintainers are developing mitigations, including blocking vulnerable modules, enforcing fail-closed configurations, and updating security documentation. Temporary workarounds include disabling the Code Interpreter tool, restricting code execution flags, and applying input sanitization to limit exposure. The vulnerabilities highlight risks in AI agent frameworks, particularly when handling untrusted input.